skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

dotnet-reverse

Reverse engineer .NET and C# binaries using dnSpyEx, de4dot, and IL patching.

21|8|Updated Aug 3, 2026
Search Tags:#dotnet#reverse engineering#deobfuscation#malware analysis#dnspy#de4dot#il patching
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill dotnet-reverse-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dotnet-reverse
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/dotnet-reverse
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill dotnet-reverse-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Analyzing .NET and C# binaries is error-prone when analysts treat managed assemblies like native code, fight obfuscators manually, or trust C# decompiler output that distorts compiler-generated logic. This Skill provides a repeatable six-phase workflow for identifying, deobfuscating, analyzing, debugging, and patching managed .NET assemblies. ## Core Features & Use Cases - Managed Binary Identification: Confirms CLR headers, metadata streams, and mscoree imports to distinguish .NET assemblies from native PE files, NativeAOT, and IL2CPP output. - Deobfuscation Pipeline: Detects and strips ConfuserEx, SmartAssembly, Babel, Eazfuscator, and .NET Reactor using de4dot, with manual anti-tamper bypass and runtime dumping fallbacks. - IL-First Analysis and Patching: Prioritizes IL view over C# decompilation for critical logic, with reliable IL patch patterns for modifying checks, constants, and removing validation. - Use Case: Given a suspected .NET info-stealer, confirm it is managed, run de4dot to produce a clean sample, locate the encrypted configuration in dnSpyEx, set a breakpoint on the decryption method, and dump the plaintext C2 address. ## Quick Start Analyze this .NET executable, deobfuscate it with de4dot if needed, and extract any embedded configuration or C2 addresses.

Frequently Asked Questions about dotnet-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a .NET executable?▼

First confirm the binary is a managed assembly by checking for a CLR header and mscoree imports. Then deobfuscate with de4dot if needed, browse classes in dnSpyEx C# view, and verify critical logic in the IL view before debugging or patching.

How to deobfuscate ConfuserEx protected .NET assemblies?▼

Run de4dot on the target, which auto-detects most ConfuserEx versions and restores control flow and strings. For newer versions with anti-tamper, patch the integrity check in the module .cctor first or dump the decrypted assembly from memory at runtime.

dnSpy vs ILSpy for .NET reverse engineering?▼

dnSpyEx is the primary choice because it combines decompilation, debugging, and an IL editor for patching in one Windows GUI. ILSpy's ilspycmd suits headless batch decompilation and is the main option on Linux and macOS where dnSpyEx is unavailable.

Can I reverse engineer .NET binaries on Linux or macOS?▼

Yes, but without the dnSpyEx GUI. Use ilspycmd for decompilation, run de4dot through the dotnet runtime, and write dnlib scripts for patching. Interactive debugging and IL editing require a Windows host.

Why does dnSpy C# edit and recompile fail?▼

The C# editor recompiles decompiled code, which often fails on compiler-generated constructs like async state machines, closures, and yield iterators. Use the IL editor instead, which modifies instructions directly with near-zero failure risk.

When should I not use dnSpy for a binary?▼

Do not use it for pure native PE files, IL2CPP-compiled Unity games, or NativeAOT output, since these lack CLR metadata. Route those to native tools like IDA or radare2 instead.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

malware-triage

Extract indicators from suspicious files via static malware analysis.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-cobalt-strike-beacon-configuration

Extract and decode Cobalt Strike beacon configurations from PE files or memory artifacts.

Community
Advanced
tinywifitinywifi
2

jarsec

Analyze Minecraft mod files for malware via static and sandbox analysis.

Community
Advanced
nolanvenholanolanvenhola
3

reverse-engineering

Automate disassembly, decompilation, and deobfuscation of binaries with Ghidra, IDA Pro, radare2, and angr.

Community
Advanced